Secueji

Demo

About

Secueji is an agentic security platform that helps smart-contract teams investigate risks and make traceable decisions across their development and operational workflows. Today, code reviews, on-chain monitoring, and administrative transactions often happen in separate tools. A reviewer sees a pull request, a monitoring service sees an event, and an operator sees a transaction request. Understanding whether these activities match the project's intended behavior requires connecting the evidence across all three. Secueji brings these entry points into one project: - Code review: Investigate GitHub pull requests against their exact code revisions, identify suspicious changes, and explain findings with source references. - On-chain activity: Examine transaction receipts, logs, and related contract state to assess observed activity against the project's context and policies. - Operations: Evaluate ABI-based administrative transaction drafts before execution, combining simulation results, deterministic rules, external risk intelligence, and AI analysis. Specialized agents can investigate relevant repository files, blockchain data, and public security information through read-only tools. Their conclusions are validated before a separate policy layer produces an outcome: allow, human review, deny, or insufficient data. The agents do not hold signing authority or override policy. Intercepta adds external risk intelligence to operation and chain-activity checks. Required screening runs independently of the agent, so a provider warning cannot disappear simply because the model overlooks it. The interface separates provider findings, agent interpretation, and the final policy decision. Each case retains its evidence, policy version, analysis, and review history. Changed transaction parameters or stale evidence cannot silently reuse an earlier approval. Secueji is a general-purpose platform. Our Base Sepolia token and escrow contracts provide concrete examples rather than defining the product's scope. It can gate operations routed through its execution path, but it cannot reverse completed blockchain transactions or block transactions that bypass it.

How it's made

We built Secueji with Next.js App Router, React, TypeScript, and Tailwind CSS, backed by PostgreSQL and Prisma. Clerk provides organization-based authentication, and server-side authorization scopes project data and actions to the active organization. A separate Node.js worker processes security jobs outside the web request lifecycle. GitHub App webhooks and Alchemy webhooks feed the platform. We verify webhook signatures, deduplicate deliveries, and enqueue jobs in PostgreSQL. Worker leases and recovery logic let investigations continue independently of the browser while preventing an expired worker from publishing stale results. Mastra powers specialized agents for code review, chain assessment, and policy judgment. Each receives task-specific instructions and case-scoped, read-only tools. These tools retrieve revision-pinned GitHub source, Alchemy-compatible RPC data, registered-ABI contract reads, project records, public pages, and OSV vulnerability information. The server controls credentials and access boundaries; the model chooses which available evidence to investigate. Our default model configuration uses Kimi K2.6 through Cloudflare Workers AI. One notable engineering challenge was combining tool-driven investigation with strict structured output. Early tests showed that forcing JSON during investigation could lead to premature answers without meaningful tool use. We separated the stages: the agent investigates first, then a tool-free structured-output processor formats its report. Zod schemas, completion checks, and evidence-reference validation reject malformed or unsupported conclusions. Mastra workflows connect evidence loading, fixed rules, agent judgment, policy decisions, and durable human-review suspension. PostgreSQL stores workflow state and traces alongside separately managed application records. Approvals bind to specific operation and policy versions rather than a mutable transaction request. We use viem for ABI-driven transaction forms, calldata encoding, contract reads, and block-pinned simulations. Intercepta supplies an additional risk signal: configured checks run before agent analysis, persist independently, and feed the policy gate directly. Agents can also investigate related addresses and tokens through supplementary tools. Required missing or expired checks prevent authorization, while “no signal” remains distinct from a safety guarantee. We verified a live Intercepta address response containing known_scammer and blacklist signals without sending funds. Our demo keeps payments on Base Sepolia and labels address intelligence separately from chain-specific transaction simulation. The full authenticated Intercepta-to-payment walkthrough remains pending validation. Testing includes Vitest unit tests, PostgreSQL integration tests, Foundry contract tests, and browser-level component checks.